The difference is that GW is selling a product, that's normal that they don't want a concurrent product using their code. On the other hand Smea and the others' work is free in all of the meanings of the word, and they don't forbid the use of their work in commercial ways as far as I know.
The same goes for Apple and their kernel. And for a bunch of things we don't trashtalk about. Stop being an ass to GW, you must recognize that they actually do an awesome work.

Except they're not really using anyone's work yet, in a way you could say they do but that's only knowing the vulnerability, someone else found the vulnerability and shared it for anyone to use. GW's coding their own implementation of the exploit and they are well within their right to do so.

If they were waiting until other devs did it open-source and then directly just copied that while adding their own DRM to require the use of GW red card then you could say they are stealing someone else's work. But as of right now no-one has stolen anything from anyone.

Well, no one has stolen anything except for the SuperCard team who blatantly stole GW's launcher to use on their card. (Maybe not stole exactly, but they are/were using GW's launcher to sell their product.)